re: How Windows PowerShell exposes passwords in clear text

markwilson — Thu, 23 Aug 2007 18:23:04 GMT

Since I wrote the original blog post on this subject, it's been pointed out to me that get-credential doesn't actually store the credentials as clear text - get-member shows that the method is actually a secure string.

My point is that, regardless of how the credential is stored, it can be retrieved in a human-readable form. I shouldn’t ever be able to say “what is the password?” and read it - what I should be able to say is, “does this hash (based on what I think the password is) match the stored hash for the password?” - that’s something very different (and far more secure in my view).

Whether this is actually a bug is questionable (it probably is by design) - unfortunately the only other type of feedback that I can submit to Microsoft is a suggestion - maybe I should “suggest” that this is a poor way in which to handle user credentials and other sensitive data.

Mark

Mark's Windows Server Blog - All Comments

re: How Windows PowerShell exposes passwords in clear text